- Russia-alig ed activity co ti ued to suppo t its wa objectives, as Bela us-alig ed th eats acto s a e becomi g ope atio ally close with Russia’s.
- Middle East-alig ed activity i c eased due to I a -alig ed activity di ected at e tities i Is ael ac oss multiple secto s; a smalle umbe of US compa ies we e also affected.
- No th Ko ea-alig ed th eat acto s did ot deviate sig ifica tly f om the types of ta gets see i p evious epo ti g pe iods; howeve , Uk ai e is bei g i c easi gly ta geted.
- APT g oups a e usi g AI a d la ge la guage models at va ious stages of thei ope atio s. Howeve , ESET has ot oticed AI substa tially eshapi g the APT la dscape ove the past six mo ths.
BRATISLAVA, Mo t eal, Oct. 28, 2026 (GLOBE NEWSWIRE) — ESET Resea ch has eleased its latest APT Activity Repo t, which highlights activities of select APT g oups that we e docume ted by ESET esea che s betwee Ap il a d Septembe 2026. Du i g this pe iod, Chi a-alig ed g oups co ducted i tellige ce-collectio ope atio s p ima ily agai st gove me tal ta gets. Middle East-alig ed activity i c eased compa ed with the p evious epo ti g pe iod, d ive mai ly by the etu of seve al established I a -alig ed g oups. Russia-alig ed activity co ti ued to suppo t its wa objectives, ta geti g gove me ts, the defe se secto , a d milita y e tities i Eu ope, with a substa tially highe umbe of ta gets i Uk ai e; Bela us-alig ed APT activity i c easi gly co ve ges with Russia’s wa p io ities. Alo gside South Ko ea, Uk ai e has become i c easi gly p omi e t amo g No th Ko ea-alig ed ta gets.
“Th oughout the busy six-mo th pe iod ESET esea che s ide tified seve al cases of APT g oups usi g AI a d la ge la guage models – LLMs – at va ious stages of thei ope atio s. Th eat acto s used AI p ima ily to accele ate tasks that would othe wise equi e pai staki g effo t, i cludi g malwa e developme t a d the c eatio of decoy websites,” says Jea -Ia Bouti , Di ecto of Th eat Resea ch at ESET.
“I some cases, this esembled vibe codi g: apid, p ompt-d ive d afti g of code, with huma ope ato s adapti g a d i teg ati g the esults i to thei toolchai s. I o e otable case, Russia-alig ed UAC-0099 i se ted a decoy equest fo i st uctio s o buildi g a uclea weapo i to a sc ipt comme t, appa e tly attempti g to t igge the safety gua d ails of LLM-based secu ity a alysis a d p eve t the i spectio of the malicious code that followed,” he adds. Despite these developme ts, ESET has ot oticed AI substa tially eshapi g the APT la dscape ove the past six mo ths.
I the Middle East, I a -alig ed FilthyFeli e, a subg oup of OilRig, a d MuddyWate esumed ope atio s afte a quiete pe iod. Most activity was di ected at e tities i Is ael ac oss multiple secto s; a smalle umbe of US compa ies we e also affected. Additio ally, FilthyFeli e also appea s to have take ove activity agai st a cellula data se vice p ovide i Uzbekista . ESET also discove ed activity by A id Vipe , a Hamas-affiliated th eat acto , agai st what appea s to be the Palesti ia Autho ity’s Mi ist y of Fo eig Affai s a d Expat iates o a affiliated gove me tal e tity.
No th Ko ea-alig ed th eat acto s did ot deviate sig ifica tly f om the types of ta gets see i p evious epo ti g pe iods. These i clude p ima ily tech ology a d c yptocu e cy compa ies, softwa e develope s, a d othe oppo tu istic ta gets. Howeve , Uk ai e is i c easi gly a ta get of No th Ko ea-alig ed acto s. This is likely elated to g owi g ties betwee Russia a d No th Ko ea, a d No th Ko ea’s i c easi g i volveme t i Russia’s wa agai st Uk ai e, ot o ly th ough i di ect milita y suppo t (mu itio s, etc.) but also th ough the deployme t of No th Ko ea soldie s. Alo gside these b oade t e ds, Laza us esumed its ta geti g of the d o e secto , typically usi g ec uitme t-themed social e gi ee i g to gai i itial access.
Russia-alig ed activity focused agai o Uk ai e a d Eu opea cou t ies. Looki g mo e closely at these activities, simila ities betwee Russia-alig ed a d Bela us-alig ed campaig s sta d out, fu the suppo ti g ou hypothesis that th eat acto s alig ed with the two cou t ies a e becomi g ope atio ally close . Bela us-alig ed g oups a e acti g as cybe p oxies o fo ce multiplie s fo Russia. We obse ved i c eased a d mo e asse tive activity f om Bela us-alig ed th eat acto s, with thei ope atio s i c easi gly eflecti g Russia’s i tellige ce p io ities i Uk ai e i some a eas. Gama edo ’s ope atio s, which a e typically ume ous, saw a sig ifica t decli e. This could be elated to Uk ai ia attacks o C imea, whe e the g oup is suspected to ope ate, a b oade est uctu i g of its ope atio s, o othe facto s that ESET co ti ues to assess.
With ega ds to Chi a-alig ed th eat g oups, o e b oade cluste of activity ta geted Taiwa ese o ga izatio s ope ati g i the semico ducto i dust y. This focus o Taiwa ’s semico ducto secto is co siste t with lo g- u i g Chi ese i dust ial espio age p io ities, a d the st ategic impo ta ce of semico ducto supply chai s to both eco omic competitio a d atio al secu ity. Additio ally, Chi a-alig ed th eat acto s a campaig s that appea to suppo t Chi ese law e fo ceme t effo ts agai st o ga ized c ime a d agai st i dividuals co ected to f aud schemes, likely i the co text of b oade egio al law e fo ceme t effo ts agai st fi a cial c ime.
ESET p oducts p otect ou custome s’ systems f om the malicious activities desc ibed i this epo t. I tellige ce sha ed he e is based mostly o p op ieta y ESET telemet y data a d has bee ve ified by ESET esea che s, who p epa e i -depth tech ical epo ts a d f eque t activity updates detaili g activities of specific APT g oups. These th eat i tellige ce a alyses assist o ga izatio s tasked with p otecti g citize s, c itical atio al i f ast uctu e, a d high-value assets f om c imi al a d atio -state-di ected cybe attacks.
Mo e i fo matio about ESET Th eat I tellige ce, which delive high-quality, st ategic, actio able, a d tactical cybe secu ity th eat i tellige ce, is available o the ESET Th eat I tellige ce page.
Fo mo e details about the me tio ed a d othe APT g oups’ activities, ead the full APT Activity Repo t, “F om espio age to dest uctio : Bela us-alig ed APT activity co ve ges with Russia’s wa p io ities,” o WeLiveSecu ity.com. Make su e to follow ESET Resea ch o Twitte (today k ow as X), BlueSky, a d Mastodo fo the latest ews f om ESET Resea ch.
A photo accompa yi g this a ou ceme t is available at https://www.globe ewswi e.com/NewsRoom/Attachme tNg/eb222a15-d7e3-4e99-a087-725cc8095087
CONTACT: Media co tact:
Jessica Beffa
jessica.beffa@eset.com
720-413-4938
